DOCSEARCHbyAlgolia
Submit Docs

dfVFS (Digital Forensics Virtual File System)

repository·main·Indexed 42 days ago

https://github.com/log2timeline/dfvfs

A library providing a unified, read-only interface for accessing file-system objects from diverse storage media and file formats used in digital forensics. Version 20260731 features a backend-driven architecture to abstract storage media and volume systems, including support for CPIO archives, SQLite databases, and SleuthKit (TSK) image wrapping via TSKFileSystemImage.

Tokens
19K
Snippets
33
Records
90
Agent score
53%

What's inside dfVFS

  1. Overview of the dfvfs.vfs package submodules

    main

    The dfvfs.vfs package is organized into specialized submodules that provide virtual file system abstractions for various forensic formats and storage types. These submodules are generally categorized by the filesystem or container type they implement (e.g., APFS, NTFS, FAT, LVM, GPT) and follow a consistent pattern of providing file_system, directory, and file_entry modules for each supported format.

    Key categories of submodules include:

    • Filesystem Implementations: Specific modules for parsing and accessing filesystems like apfs, fat, hfs, ntfs, lvm, and cpio.
    • Container & Partitioning: Modules for handling structures like gpt, lvm, and apfs_container.
    • Stream & Attribute Handling: Specialized modules for managing metadata and data streams, such as ntfs_data_stream, hfs_data_stream, apfs_attribute, and various compressed_stream or encrypted_stream implementations.
    • Virtual/Abstraction Layers: Modules like fake_file_system or data_range_file_system used for creating virtualized or constrained views of data.

  2. Overview of dfVFS

    main
    dfVFS (Digital Forensics Virtual File System) is a library that provides read-only access to file-system objects across various storage media types and file formats. It offers a generic interface for accessing files, using multiple back-ends to implement support for different storage media, volume systems, and file systems. It is a standalone project derived from the Plaso project.

  3. Overview of dfVFS (Digital Forensics Virtual File System)

    main
    dfVFS provides a read-only, generic interface for accessing file-system objects across various storage media types, volume systems, and file formats. It achieves this through a backend-driven architecture where specific implementations for different storage media and file systems are abstracted behind a unified interface. This allows developers to interact with diverse forensic data sources using a consistent set of operations.

  4. Overview of the dfvfs.analyzer package submodules

    main

    The dfvfs.analyzer package provides specialized analyzer modules and helpers for various digital forensics file systems, containers, and archive formats. Developers can use these submodules to implement or extend analysis capabilities for specific forensic artifacts.

    Supported analysis types include:

    • File Systems: apfs, fat, hfs, lvm, ntfs, xfs.
    • Disk Containers & Virtual Disks: apfs_container, bde, luksde, qcow, vhdi, vmdk, vshadow.
    • Archives & Compression: bzip2, cpio, gzip, tar, xz, zip.
    • Other Forensic Formats: apm, cs, ewf, ext, gpt, modi, phdi, tsk.

  5. Overview of the dfvfs.compression package

    main
    The dfvfs.compression package provides decompression capabilities for the Digital Forensics Virtual File System. It is organized into several specialized submodules, each handling a specific compression format. Users can interact with the package through a central manager or by using specific decompressor modules depending on the required compression algorithm.

  6. Overview of the dfvfs.file_io package submodules

    main

    The dfvfs.file_io package provides specialized I/O modules for interacting with various digital forensics file formats, file systems, and data streams. Developers can use these submodules to perform read-only operations on specific forensic artifacts or container formats.

    Supported file systems and formats include:

    • File Systems: apfs_file_io, fat_file_io, hfs_file_io, ntfs_file_io, xfs_file_io.
    • Disk/Partition Formats: gpt_file_io, lvm_file_io, tsk_partition_file_io.
    • Virtual Machine/Disk Images: qcow_file_io, vhdi_file_io, vmdk_file_io, ewf_file_io (Expert Witness Format).
    • Archives/Containers: cpio_file_io, tar_file_io, zip_file_io, gzip_file_io.
    • Specialized I/O: compressed_stream_io, encrypted_stream_io, encoded_stream_io, data_range_io, sqlite_blob_file_io.

  7. Overview of dfvfs.resolver_helpers submodules

    main
    The dfvfs.resolver_helpers package provides specialized helper modules designed to assist in resolving various file system, container, and stream types within the Digital Forensics Virtual File System (dfVFS). These helpers are organized by the specific technology or format they handle, such as disk images, compressed streams, or specific file systems (e.g., APFS, NTFS, XFS).

  9. Explore the dfvfs.lib submodules

    main

    The dfvfs.lib package is organized into several submodules that provide specialized support for different forensic file system formats, data structures, and helper utilities. Developers can use these submodules to interact with specific forensic artifacts:

    File System & Partition Helpers

    • dfvfs.lib.apfs_helper: Support for Apple File System (APFS).
    • dfvfs.lib.lvm_helper: Support for Logical Volume Management (LVM).
    • dfvfs.lib.raw_helper: Support for raw disk images.
    • dfvfs.lib.tsk_partition: Support for The Sleuth Kit (TSK) partitions.
    • dfvfs.lib.vshadow_helper: Support for Volume Shadow Copies.

    Encryption & Container Helpers

    • dfvfs.lib.bde_helper: BitLocker Drive Encryption support.
    • dfvfs.lib.ewf_helper: Expert Witness Format (EWF) support.
    • dfvfs.lib.luksde_helper: LUKS (Linux Unified Key Setup) support.

    Data Formats & Archives

    • dfvfs.lib.cpio: Support for CPIO archives.
    • dfvfs.lib.data_format: General data format utilities.
    • dfvfs.lib.gzipfile: Gzip file handling.
    • dfvfs.lib.sqlite_database: SQLite database interaction.

    Core Utilities

    • dfvfs.lib.definitions: Core definitions used across the library.
    • dfvfs.lib.errors: Custom error types and exception handling.
    • dfvfs.lib.glob2regex: Utilities for converting glob patterns to regular expressions.
    • dfvfs.lib.tsk_image & dfvfs.lib.tsk_time: The Sleuth Kit image and time handling utilities.

  10. Explore the dfvfs package subpackages

    main

    The dfvfs (Digital Forensics Virtual File System) package is organized into several specialized subpackages. Depending on your requirements, you may need to interact with these specific modules:

    • dfvfs.vfs: Core Virtual File System abstractions.
    • dfvfs.volume: Volume management and handling.
    • dfvfs.path: Path manipulation and resolution within the VFS.
    • dfvfs.file_io: File input/output operations.
    • dfvfs.mount: Mounting functionality.
    • dfvfs.resolver: Path resolution logic.
    • dfvfs.encryption & dfvfs.compression: Handling of encrypted or compressed data layers.
    • dfvfs.credentials: Management of access credentials.
    • dfvfs.encoding: Character encoding handling.
    • dfvfs.serializer: Data serialization/deserialization.
    • dfvfs.analyzer, dfvfs.helpers, dfvfs.lib, dfvfs.resolver_helpers: Utility and support modules.

  11. Use the dfvfs.credentials package for filesystem authentication

    main
    The dfvfs.credentials package provides the necessary abstractions for managing authentication credentials required to access various encrypted or protected virtual file systems within dfVFS. It includes specialized submodules for different encryption types and credential management strategies.

  12. Explore dfvfs.volume submodules and volume systems

    main

    The dfvfs.volume package provides various volume system implementations for interacting with different disk and partition structures. Depending on the forensic image or storage type you are analyzing, you may need to use one of the following specialized submodules:

    • APFS: dfvfs.volume.apfs_volume_system for Apple File System volumes.
    • APM: dfvfs.volume.apm_volume_system for Apple Partition Map volumes.
    • CS: dfvfs.volume.cs_volume_system for Core Storage volumes.
    • GPT: dfvfs.volume.gpt_volume_system for GUID Partition Table volumes.
    • LVM: dfvfs.volume.lvm_volume_system for Logical Volume Manager volumes.
    • TSK: dfvfs.volume.tsk_volume_system for The Sleuth Kit compatible volumes.
    • VShadow: dfvfs.volume.vshadow_volume_system for Volume Shadow Copy volumes.
    • Factory: dfvfs.volume.factory which likely provides mechanisms to instantiate the correct volume system automatically.